#4163 fix(daemon): preserve active holds when renewal is canceled

Summary

An aborted renewal could delete an active human-control hold and reopen mutation admission. Keep the active entry until renewal activates atomically; cancellation preserves its metadata and TTL.

Two files; production changes stay inside LeaseRegistry. FU-HOLD audit follow-up. No scope expansion. Validation blocker: #4060.

Validation

• Base: a0e7c7dc239922bf93adaceff20a2f7e78579146.
• Tested head: 6f028bf6c305aa25288dce7b161f0884fa2b2a6f.
• pnpm exec vitest run --project unit-core packages/daemon/src/resources/__tests__/lease-registry-human-control.test.ts: added before implementation; base 1 failed (hold list became empty); head 1 passed. Registry/expiry/HTTP focused suites: 52 passed.
• pnpm format and pnpm build: passed.
• pnpm check:affected --run --head 6f028bf6c305aa25288dce7b161f0884fa2b2a6f: base-blocked, receipt .tmp/validation/run-nlfJ5l/receipt.json, exactCommit=true, checkoutChanged=false. Six checks passed; related tests 303 passed / 1 failed. Identical command on freshly installed/built unchanged base reproduced apple-platform-output-guard.test.ts:385, record timeout after 20s, 303 passed / 1 failed (#4060). pnpm gate unit: passed, 16,966 tests passed / 1 skipped; smoke 76 passed / 6 skipped.
• Live iOS 26.2, local / CAE86E90-9D1D-42A4-B020-179F0FE092DE: worktree-built HTTP daemon, private /private/tmp/fu-hold-live state. Worktree CLI takeover renewed the same active hold; takeover status showed advanced updatedAt. Bound device client back returned DEVICE_IN_USE, reason human_control_active. After Ctrl+C, status was empty and back reached the native runner, which reported no back control on Settings' root. Sessions, hold, and daemon cleaned up. Cancellation timing is proven by the unit regression.
• Cold self-review only; no independent reviewer. GitHub Integration Tests, Coverage, and device lanes remain CI obligations; local skips do not claim those passed.